News for hackers. Stuff that matters.

A comment on CVE-2015-0235 – GHOST: glibc gethostbyname buffer overflow. Parent comment

Re:CVE-2015-0235 – GHOST: glibc gethostbyname buffer overflow by tveita on Tuesday January 27, 2015 @11:51AM (#8954111)
The upstream patch is dated "Mon, 21 Jan 2013". Does this affect Redhat and Debian because they use older glibc versions and didn't backport this fix?
[ Parent | on HN ]
Re:CVE-2015-0235 – GHOST: glibc gethostbyname buffer overflow by 0x0 on Tuesday January 27, 2015 @11:52AM (#8954121)
yes
[ Parent | on HN ]
Re:CVE-2015-0235 – GHOST: glibc gethostbyname buffer overflow by eslaught on Tuesday January 27, 2015 @12:23PM (#8954342)
What versions are affected? E.g. Ubuntu 14.04 appears to be on 2.19-0ubuntu6.5 (just updated). Does that include the fix?
[ Parent | on HN ]
Re:CVE-2015-0235 – GHOST: glibc gethostbyname buffer overflow by phoboslab on Tuesday January 27, 2015 @12:52PM (#8954525)
You can check the libc version with:

dpkg -s libc6

For my Debian 7 servers it reports "Version: 2.13-38+deb7u7" after upgrading. Everything below that (eg. "*u6") is vulnerable. I don't know about the specific version numbers in Ubuntu though.

Edit: the fixed Ubuntu version is "2.15-0ubuntu10.10"

[ Parent | on HN ]
Re:CVE-2015-0235 – GHOST: glibc gethostbyname buffer overflow by skuhn on Tuesday January 27, 2015 @01:35PM (#8954782)
Per the Ubuntu security advisory for this, 14.04 is not impacted.
[ Parent | on HN ]
Re:CVE-2015-0235 – GHOST: glibc gethostbyname buffer overflow by jerematasno on Tuesday January 27, 2015 @09:10PM (#8957603)
Full blog post coming, but 14.04 was never vulnerable. glibc 2.17 was the last vulnerable version.
[ Parent | on HN ]